Medium1 markMultiple Choice
Domain 5.3: Viewing audit logsCloud LoggingAudit LogsLogs ExplorerTroubleshooting

GCP ACE · Question 50 · Domain 5.3: Viewing audit logs

You are using the Logs Explorer to investigate an issue. You want to filter the logs to show ONLY Admin Activity audit logs related to Compute Engine instances that were created in the last hour.

Which TWO filters must you include in your Logs Explorer query? (Select TWO)

Answer options:

A.

resource.type="gce_instance"

B.

logName="projects/YOUR_PROJECT/logs/cloudaudit.googleapis.com%2Factivity"

C.

severity="ERROR"

D.

logName="projects/YOUR_PROJECT/logs/cloudaudit.googleapis.com%2Fdata_access"

E.

resource.type="compute_engine_project"

How to approach this question

Identify the correct logName for Admin Activity and the correct resource.type for Compute Engine instances.

Full Answer

Filter by the log name 'cloudaudit.googleapis.com/activity' and filter by the resource type 'gce_instance'.
To filter logs effectively in the Logs Explorer, you use the Logging query language. To find Admin Activity logs for Compute Engine instances, you need two main filters. First, you filter by the resource type using `resource.type="gce_instance"`. Second, you filter by the specific log name for Admin Activity logs, which is `logName="projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity"`. You would then use the time selector in the UI to restrict the view to the last hour.

Common mistakes

Selecting Data Access logs instead of Activity logs, or filtering by ERROR severity (which would hide successful VM creations).

Practice the full GCP Associate Cloud Engineer Practice Exam 6

50 questions · hints · full answers · grading

More questions from this exam